A major problem in supporting the automated analysis of IoT security discussions from SO is that such security discussions can be buried inside
technical discussions of developers. For example, consider the answer to the SO question \(Q_{33004863}\) in Figure REF .
The question concerns two security software libraries (i.e., APIs), both of which contain the implementation of the `Datagram Transport Layer Security (DLTS)' protocol.
The DLTS is a communication protocol to provide security for software applications that operate in packet-switched networks where a datagram is a basic transfer unit.
A datagram has a header and payload section. The protocol uses datagrams in a stateless manner to prevent malicious attacks like eavesdropping, tampering, or message
forgery. The asker of \(Q_{33004863}\) is particularly interested in the DLTS implementation in the tinyDLTS library because he needs to use the protocol in his IoT device.
However, he is also worried about whether the tinyDLTS API offers limited features due to constrained resources and data size. The answer to the question does confirm that
the tinyDLTS has limited security features, e.g., it does not support X.509 certificates. The last line of the answer, however, notes that the API is usable.
Indeed, while the first three sentences
in the answer are related to the security features of the tinyDLTS API, the last line is about the usability aspect of the API. Therefore, if we simply
are interested in learning about security aspects of software in SO posts, we may want to only consider the first three sentences of the answer. This means
that sentence-level security aspect detection in SO posts can be more precise and less noisy than post-level analysis.
Therefore, we need automated techniques to precisely detect security aspects in SO developer discussions.
Previously, Uddin and Khomh [1]} developed a supervised shallow machine learning classifier to detect security aspects at sentence-level in
SO posts. However, the classifier was not trained and tested on IoT-related sentences. This can affect the performance of the classifier model as IoT security is different from traditional security. For example, in the IoT domain, X.509 indicates a public key certificate that is related to security. But in our traditional computation, we can consider this an entity or a number. A generic classifier model can't discern such security details from non-security discussions as the model is trained and designed to have generic knowledge. In fact, a security-specific model can not discern such discussions. Thus, we need to design a classifier model that has IoT domain knowledge. Moreover, the classifier that Uddin et al.[2]} used also did not use recent advances in deep learning transformer models, which are found to outperform shallow learning models in software engineering (SE) datasets (e.g., sentiment classification [3]}).
